claim-dale[.]pages[.]dev

This domain, claim-dale.pages.dev, is identified as a high-severity brand impersonation threat targeting the Across protocol. The site presents itself as an official AirDrop token distribution portal under the fabricated title 'Dale | AirDrop,' designed to deceive users into submitting wallet credentials or approving malicious transactions. Infrastructure analysis reveals the use of a drainer kit, likely deployed to systematically extract cryptocurrency assets from compromised wallets upon interaction. Technical indicators confirm the domain's malicious nature. The resource resolves to IP address 172.66.47.176, hosted on Cloudflare’s AS13335 infrastructure in the United States. Registered through Cloudflare, Inc. on January 25, 2026, the domain employs a Google Trust Services SSL certificate (WE1) to lend an appearance of legitimacy. Detection metrics include a VirusTotal score of 15/95, with Google Safe Browsing explicitly flagging it as phishing. The domain appears on two independent security blocklists, and two specialized detection systems have already classified it as malicious. As of the latest assessment, claim-dale.pages.dev remains active and unremediated, posing an ongoing risk to users of the Across protocol. No takedown or sinkholing actions have been observed, and the domain continues to resolve without interruption. Users are advised to treat any interaction with this domain as fraudulent, avoid entering credentials, and revoke any previously granted wallet permissions. Organizations should update blocklists to include the domain and its associated IP, while monitoring for further indicators of compromise linked to this campaign.